@indigoai-us/hq-cli 5.345.117 → 5.345.118

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [5.345.118] — 2026-10-13
+- `hq integrations call` and `hq integrations tools` now work for the
+  built-in Google Workspace, Linear and Slack connections. Calls use the
+  tool's own name (for example `google.drive.picked.list`), and `tools`
+  lists only the selected connection's tools. `--args` may not set
+  `companyUid`, `connectionId` or `idempotencyKey`; hq fills those in from
+  the selected connection.
+
 ## [5.345.117] — 2026-10-13
 - `hq lanes monitor-check` answers a session that owns no active lane from the lane-record directory alone, without loading the command graph. The Claude Stop hook runs it after every turn in every session; per-call CPU drops from about 545 ms to about 60 ms. Sessions with an active lane, corrupt records, or conflict sidecars still use the full command.
 

package/dist/commands/integrations-core.d.ts

@@ -257,6 +257,12 @@ export interface UsableAppsResult {
     viewerAccessKnown: boolean;
     apps: UsableApp[];
 }
+/**
+ * Built-in providers expose their tools under their own names
+ * (`google.drive.picked.list`), not through the factory passthrough
+ * `<prefix>.mcp.tools.call`, which the gateway never registers for them.
+ */
+export declare function isBuiltInGatewayProvider(provider: string): boolean;
 /**
  * The apps the caller may use, from `GET /v1/integrations/admin?view=summary`.
  * A row counts only when all of these hold, mirroring the gateway's checks:
@@ -296,7 +302,7 @@ export declare function resolveConnection(token: string, companyUid: string, app
 }, recoveryOpts?: {
     allowSingleRevoked?: boolean;
 }): Promise<AdminConnection>;
-export declare function callGateway(token: string, params: Record<string, unknown>, idempotencyKey?: string): Promise<GatewayMessage>;
+export declare function callGateway(token: string, params: Record<string, unknown>, idempotencyKey?: string, method?: "tools/call" | "tools/list"): Promise<GatewayMessage>;
 /**
  * Gateway results arrive MCP-style: `{ content: [{ type: "text", text }] }`
  * where `text` is the provider's JSON. Unwrap to the inner payload; fall back

package/dist/commands/integrations-core.js

@@ -368,6 +368,14 @@ const GATEWAY_SERVED_STATUSES = new Set(["connected", "needs-attention"]);
  * gateway as `ProviderUnsupported`.
  */
 const STATIC_GATEWAY_PROVIDERS = new Set(["google-workspace", "linear", "slack"]);
+/**
+ * Built-in providers expose their tools under their own names
+ * (`google.drive.picked.list`), not through the factory passthrough
+ * `<prefix>.mcp.tools.call`, which the gateway never registers for them.
+ */
+export function isBuiltInGatewayProvider(provider) {
+    return STATIC_GATEWAY_PROVIDERS.has(provider);
+}
 const MAX_APP_NAME_LENGTH = 60;
 /**
  * Display names are set by whoever installed the app and end up in agent
@@ -561,7 +569,9 @@ export async function resolveConnection(token, companyUid, app, opts, recoveryOp
     }
     return selectConnection(connections, opts);
 }
-function gatewaySubcommandFor(params) {
+function gatewaySubcommandFor(params, method) {
+    if (method === "tools/list")
+        return "tools_list";
     const name = params.name;
     if (typeof name !== "string")
         return "other";
@@ -569,10 +579,13 @@ function gatewaySubcommandFor(params) {
         return "tools_list";
     if (name.endsWith(".mcp.tools.call"))
         return "tools_call";
+    // Built-in providers are called by the tool's own name, with no passthrough.
+    if (!name.includes(".mcp."))
+        return "tools_call";
     return "other";
 }
-export async function callGateway(token, params, idempotencyKey) {
-    const gatewaySubcommand = gatewaySubcommandFor(params);
+export async function callGateway(token, params, idempotencyKey, method = "tools/call") {
+    const gatewaySubcommand = gatewaySubcommandFor(params, method);
     const deadline = Date.now() + ASYNC_GATEWAY_DEADLINE_MS;
     const res = await vaultApiFetch({
         token,
@@ -581,7 +594,7 @@ export async function callGateway(token, params, idempotencyKey) {
         body: {
             jsonrpc: "2.0",
             id: `hq-cli-${randomUUID()}`,
-            method: "tools/call",
+            method,
             params,
         },
     });

package/dist/commands/integrations.js

@@ -54,12 +54,39 @@ import chalk from "chalk";
 import { ensureCognitoIdToken } from "../utils/cognito-session.js";
 import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
 import { redactSensitiveUrl, redactSensitiveUrls, redactUrlsInText } from "../utils/redact-url.js";
-import { IntegrationsCliError, bareProvider, callGateway, fetchConnections, fetchUsableApps, isClientError, printHealthNotice, printJson, printIntegrationCallResultJson, raiseIfUnauthorized, raiseIfUpstreamUnavailable, gatewayResultIsError, selectConnection, revokedConnectionDetails, toolPrefixForProvider, unwrapGatewayResult, queuedOutcome, } from "./integrations-core.js";
+import { IntegrationsCliError, bareProvider, callGateway, fetchConnections, fetchUsableApps, isBuiltInGatewayProvider, isClientError, printHealthNotice, printJson, printIntegrationCallResultJson, raiseIfUnauthorized, raiseIfUpstreamUnavailable, gatewayResultIsError, selectConnection, revokedConnectionDetails, toolPrefixForProvider, unwrapGatewayResult, queuedOutcome, } from "./integrations-core.js";
 import { registerConnectCommands } from "./integrations-connect.js";
 import { registerImportCommands } from "./integrations-import.js";
 import { registerManageCommands } from "./integrations-manage.js";
 import { registerSlackCommands } from "./integrations-slack.js";
 import { fetchPendingApprovals } from "./integrations-api.js";
+/** Routing ids hq sets on a built-in tool call; never accepted from --args. */
+const BUILT_IN_ROUTING_ARGS = ["companyUid", "connectionId", "idempotencyKey"];
+/**
+ * hq sets the routing ids on every built-in call and refuses them in --args,
+ * so discovery must not list them as inputs the caller provides.
+ */
+function withoutRoutingArgs(tool) {
+    const schema = tool.inputSchema;
+    if (!schema || typeof schema !== "object" || Array.isArray(schema))
+        return tool;
+    const { properties, required, ...rest } = schema;
+    const routing = new Set(BUILT_IN_ROUTING_ARGS);
+    const next = { ...rest };
+    if (properties && typeof properties === "object" && !Array.isArray(properties)) {
+        next.properties = Object.fromEntries(Object.entries(properties).filter(([key]) => !routing.has(key)));
+    }
+    else if (properties !== undefined) {
+        next.properties = properties;
+    }
+    if (Array.isArray(required)) {
+        next.required = required.filter((key) => !(typeof key === "string" && routing.has(key)));
+    }
+    else if (required !== undefined) {
+        next.required = required;
+    }
+    return { ...tool, inputSchema: next };
+}
 export { IntegrationsCliError, callGateway, fetchConnections, fetchUsableApps, queuedOutcome, selectConnection, toolPrefixForProvider, unwrapGatewayResult, } from "./integrations-core.js";
 /**
  * Gateway metadata is additive and may be absent when talking to an older
@@ -285,16 +312,33 @@ export function registerIntegrationsCommand(program) {
         .action(async (opts) => {
         const token = await ensureCognitoIdToken();
         const companyUid = await getCompanyUid(token, opts.company);
-        const connection = selectConnection(await fetchConnections(token, companyUid), opts);
+        const connections = await fetchConnections(token, companyUid);
+        const connection = selectConnection(connections, opts);
         if (reportRevokedConnection(connection, opts))
             return;
-        const prefix = toolPrefixForProvider(connection.provider);
-        const message = await callGateway(token, {
-            companyUid,
-            name: `${prefix}.mcp.tools.list`,
-            arguments: { companyUid, connectionId: connection.id },
-        });
-        const payload = unwrapGatewayResult(message.result);
+        let payload;
+        const builtIn = isBuiltInGatewayProvider(connection.provider);
+        if (builtIn) {
+            // Built-in providers answer the gateway's own tools/list, which spans
+            // every connection in the company; keep only this connection's tools.
+            const message = await callGateway(token, { companyUid }, undefined, "tools/list");
+            const listed = unwrapGatewayResult(message.result);
+            payload = {
+                ...listed,
+                tools: (listed?.tools ?? [])
+                    .filter((tool) => tool.annotations?.connectionId === connection.id)
+                    .map(withoutRoutingArgs),
+            };
+        }
+        else {
+            const prefix = toolPrefixForProvider(connection.provider);
+            const message = await callGateway(token, {
+                companyUid,
+                name: `${prefix}.mcp.tools.list`,
+                arguments: { companyUid, connectionId: connection.id },
+            });
+            payload = unwrapGatewayResult(message.result);
+        }
         const tools = payload?.tools ?? [];
         if (tools.length === 0) {
             if (opts.json) {
@@ -331,7 +375,14 @@ export function registerIntegrationsCommand(program) {
             const badge = formatToolBadge(tool);
             console.log(`${chalk.bold(tool.name)}${badge ? `  ${badge}` : ""}${label}${required ? `  ${chalk.dim(required)}` : ""}`);
         }
-        console.log(chalk.dim(`\n${tools.length} tools. Describe inputs: hq integrations tools --provider ${bareProvider(connection.provider)} --describe <tool>\nCall one with: hq integrations call <tool> --provider ${bareProvider(connection.provider)} --args '<json>'`));
+        // `--provider` resolves to the first matching connection, so when
+        // several connections share this provider the hint must name this one.
+        const sharedProvider = builtIn &&
+            connections.some((c) => c.id !== connection.id && c.status !== "revoked" && c.provider === connection.provider);
+        const selector = sharedProvider
+            ? `--connection ${connection.id}`
+            : `--provider ${bareProvider(connection.provider)}`;
+        console.log(chalk.dim(`\n${tools.length} tools. Describe inputs: hq integrations tools ${selector} --describe <tool>\nCall one with: hq integrations call <tool> ${selector} --args '<json>'`));
     });
     integrations
         .command("call <tool>")
@@ -359,20 +410,38 @@ export function registerIntegrationsCommand(program) {
         const connection = selectConnection(await fetchConnections(token, companyUid), opts);
         if (reportRevokedConnection(connection, { ...opts, fail: true }))
             return;
-        const prefix = toolPrefixForProvider(connection.provider);
         const idempotencyKey = opts.idempotencyKey ?? `hq-cli-${randomUUID()}`;
-        const message = await callGateway(token, {
-            companyUid,
-            acceptAsync: true,
-            name: `${prefix}.mcp.tools.call`,
-            arguments: {
+        let gatewayParams;
+        if (isBuiltInGatewayProvider(connection.provider)) {
+            // Built-in tools take their args flat beside the routing ids, so an
+            // arg with a routing name would redirect the call; refuse it.
+            const reserved = BUILT_IN_ROUTING_ARGS.filter((key) => key in parsedArgs);
+            if (reserved.length) {
+                throw new IntegrationsCliError(`--args cannot include ${reserved.join(", ")}: it is set by hq from the selected connection.`, { expected: true });
+            }
+            gatewayParams = {
+                companyUid,
+                acceptAsync: true,
+                name: tool,
+                arguments: { ...parsedArgs, companyUid, connectionId: connection.id, idempotencyKey },
+            };
+        }
+        else {
+            const prefix = toolPrefixForProvider(connection.provider);
+            gatewayParams = {
                 companyUid,
-                connectionId: connection.id,
-                toolName: tool,
-                arguments: parsedArgs,
-                idempotencyKey,
-            },
-        }, idempotencyKey);
+                acceptAsync: true,
+                name: `${prefix}.mcp.tools.call`,
+                arguments: {
+                    companyUid,
+                    connectionId: connection.id,
+                    toolName: tool,
+                    arguments: parsedArgs,
+                    idempotencyKey,
+                },
+            };
+        }
+        const message = await callGateway(token, gatewayParams, idempotencyKey);
         const payload = unwrapGatewayResult(message.result);
         const queued = queuedOutcome(payload);
         if (queued) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.117",
+  "version": "5.345.118",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {